Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b3781a519d7b547…

MALICIOUS

PDF

77.2 KB Created: 2021-03-30 21:38:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dad3f9b0bfd43d707b7a91d4acb842fb SHA-1: 71d9afe6abb3dd7bdc6ee903de1c84e41312d4b2 SHA-256: 9b3781a519d7b547d97fc49c7ae2fbac16d7fb0bc36004b291c268edf327ad4d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI, pointing to a URL that promises free movies. This is a common lure for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or trojan delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=peliculas+completas+en+espa%25C3%25B1ol+latino+gratis+online
    • https://static.s123-cdn-static.com/uploads/4475988/normal_5fc7268a7240a.pdf
    • https://cdn-cms.f-static.net/uploads/4445739/normal_602939c927192.pdf
    • http://tixesikixux.mygamesonline.org/accounting_principles_concepts_and_conventions_with_examples.pdf
    • http://fezanabuxa.22web.org/ps_vita_charger_substitute.pdf
    • http://gojavodevagajuw.mygamesonline.org/90579566437.pdf
    • http://zagejudivavi.sportsontheweb.net/konubalimesepijil.pdf
    • http://jekiroxawuto.iblogger.org/excel_spreadsheet_address_book_template.pdf
    • https://cdn-cms.f-static.net/uploads/4481828/normal_604a15c433e5c.pdf
    • https://cdn-cms.f-static.net/uploads/4474223/normal_6023bf0e3d0bc.pdf
    • https://cdn-cms.f-static.net/uploads/4369932/normal_604348879b9cb.pdf
    • http://nugotokilovol.iblogger.org/pluralisme_di_malaysia.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zunaduxa/fororewazifakegaxumu.pdf
    • http://tekunobujolid.epizy.com/hookah_bar_dj_chetas_song.pdf
    • https://a1359116-1358-4cde-afc5-3600b4bb50db.filesusr.com/ugd/3b0c81_ac5a62632aa5434a9a7dfb6d80ac35be.pdf?index=true
    • http://dulibifusarumo.rf.gd/2650540862.pdf
    • http://wejajesenopezoj.onlinewebshop.net/open_country_sportsmans_kitchen_food_dehydrator_and_jerky_maker.pdf
    • https://45f61934-b4a1-4335-a9e3-e142d9465b5b.filesusr.com/ugd/0dd040_f182ebe8fe4848c2afb10703c087c996.pdf?index=true
    • https://s3.amazonaws.com/diwitapezu/61184457177.pdf
    • http://zopefaku.rf.gd/bevogopimokuburedeki.pdf
    • https://s3.amazonaws.com/xidazeze/crystal_reports_tutorial_c.pdf
    • http://nufavonazimu.epizy.com/50495368436.pdf
    • https://0491f86b-060d-4f4a-be23-b0d01488777f.filesusr.com/ugd/faa7ef_8fddf725e2264fc29357892e2c587a90.pdf?index=true
    • https://s3.amazonaws.com/wajibile/endocrine_society_guidelines_medullary_thyroid_cancer.pdf
    • http://denotepisijolib.rf.gd/bahria_town_karachi_golf_city_map.pdf
    • http://zojimako.rf.gd/flir_one_lt_pro.pdf
    • https://bed1e925-73f7-457c-87ff-53f226988024.filesusr.com/ugd/d4a8ce_26f8e75c1def4014933fe869142cfe3d.pdf?index=true
    • http://gudoxigamodire.rf.gd/55081896895.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebd8.bin
c95627368012cf11363308ea209858a72a5607ccb15d23163a96c97d5d9f56a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBD8 5464 bytes
font_01_sfnt_off0000fe18.bin
4bd577a607b96ac9e1840e7bead574ac4c13860ab2929dcfdbeb2a37034ccc59		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE18 11760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.